Our web honeypots picked up some exploit attempts for CVE-2014-6287 which is a command execution vulnerability in the Rejetto HTTP File Server (aks HFS or HttpFileServer) product. Here is PoC vulnerability details from PacketStorm:
Honeypot Attack Example
One of our web honeypot systems located in Berlin, Germany received an attack from a system in China:
Here is a screenshot from the ModSecurity audit log entry for the attack:
The yellow highlighted section shows the Null Byte character being used to initiate the Windows OS command execution payload. The blue highlighted section is the payload of the attack which is using Microsoft VBScripting.
VBScript Exploit Payload
Here is what the VBScript code looks like once it is urldecoded and beautified for readability:
Here is a breakdown of what this attack script is doing:
- The command uses "cmd.exe" to create a VBScript called "22222.vbs".
- Script uses XML HTTP Requests (XHR) to try and connect to two different malware repository hosts (123.108.109.100 and 178.33.196.164) on ports 53 (DNS), 80 (HTTP) and 443 (HTTPS). As of this morning, only the 178.33.196.164 host was online. This is a server located in Paris, France.
- The XHR connections try and download a file called "getsetup.exe" and save it locally as a file called "ko.exe".
- The script then tries to execute the "ko.exe" script.
- Finally the script deletes itself.
getsetup.exe Analysis
I checked the file hash and found that there are details from a previous upload on the Malwr site:
Fortunately, AV detection rates seem pretty good:
In digging a bit deeper, it appears that this program is also known as "Iptables/Iptablex" and is a DDoS botnet tool as outlined in this presentation from Avast:
Mitigations
Update Software
The first step in preventing these types of exploits is to ensure that your software is up to date on patches. You can download the HFS software updates with the patches here.
Scan for Vulnerabilities
If you want to check your systems to see if your FHS version is vulnerable, you can also use this Metasploit module.
Use a Web Application Firewall (WAF)
As we showed from the honeypot alert, using a WAF can help to prevent 0-day exploits such as this one by generically identifying attack payloads that have:
- Null Bytes
- OS Command Injections
Verify Network Firewall Egress Rules
The full attack chain sequence will work only if exploited web servers are able to initiate OUTBOUND connections to malware repository sites. Organizations should implement egress firewall rules that prevent web servers from initiating outbound connections (except perhaps to authorized locations).
